Bluesky claims its new contact import feature is 'privacy-first'

"Unlike rivals, it claims it's not sacrificing privacy to do it. The Find Friends feature is "privacy-first by design," unlike what Bluesky says are "poorly implemented or abused" processes elsewhere. You verify your phone number, upload your contacts, and get pinged if - and only if - someone in your contacts book chose to do the same. Bluesky says there are a few things making its approach different:"

"It only works if both people participate. You'll only be matched with someone if you both have each other in your contacts and you've both opted into Find Friends. If you never use this feature, you'll never be findable through it. Your coworker can't use it to look you up unless you've uploaded their number from your contacts. You verify your number first. Before any matching happens, you prove that you own your phone number."

"Your contact data is protected even if something goes wrong. We store phone numbers as hashed pairs - your number combined with each contact's number - which makes the data exponentially harder to reverse-engineer. That encryption is also tied to a hardware security key stored separately from our database. You can remove your data anytime. Changed your mind? You can delete your uploaded contacts and opt out entirely."

Bluesky's Find Friends lets users discover people from their contacts by uploading phone numbers and opting into matching. Matching occurs only if both people have each other in their contacts and both opt into the feature. Users must verify ownership of their phone number before any matching, preventing random-number uploads. Phone numbers are stored as hashed pairs combining the user's number with each contact's number, and encryption is tied to a hardware security key stored separately from the database. Users can delete uploaded contacts and opt out at any time. The feature is initially available to mobile app users in specified countries and accessed via Settings.

Read at The Verge